CVE-2026-41022

MediumCVSS 5.9/10Last modified Nov 4, 2026

Description

Eaton easySoft improperly validates TLS certificates presented by easyE4 devices. A network-adjacent attacker could exploit this weakness to perform a man-in-the-middle attack and potentially intercept or modify communications between easySoft and easyE4.

Metrics

CVSS 3.1 5.9/10CVSS:3.1/AV:N/AC:L/PR:H/UI:R/S:C/C:L/I:L/A:L

Weakness enumeration

CWE-295

Affected software

Source: the vendor's advisory (CNA). NVD analysis pending.

Vendor	Product	Versions
Eaton	easySoft	< 8.46

References

https://www.eaton.com/content/dam/eaton/company/news-insights/cybersecurity/security-bulletins/eaton-va-2026-1017.pdf

Timeline

Published: Oct 27, 2026
Last modified: Nov 4, 2026
NVD status: Awaiting Analysis

Related CVEs from 2026

CVE-2026-41036.4Insufficient HTML sanitization in the Publisher Portal and Developer Portal allows untrusted user input to be rendered without proper encodi CVE-2026-410306.2In ONLYOFFICE DesktopEditors before 9.3.0, the update service allows attackers to perform actions on files with SYSTEM privileges.CVE-2026-410318.7A Stored Cross-Site Scripting vulnerability in Vinna Process Monitor Version 4.0 Service Pack 1 (Build 63255) allows an authenticated remote CVE-2026-410327.5It is possible for an unauthenticated adjacent attacker to download log files of the controller, which may disclose some restricted informat CVE-2026-410345.0ONLYOFFICE DocumentServer before 9.3.0 has an untrusted pointer dereference in XLS processing/conversion (via pictFmla.cbBufInCtlStm and oth CVE-2026-410357.8In rsync 3.0.1 through 3.4.1, receive_xattr relies on an untrusted length value during a qsort call, leading to a receiver use-after-free. T CVE-2026-410368.8This vulnerability exists in Quantum Networks router due to inadequate sanitization of user-supplied input in the management CLI interface. CVE-2026-410378.8This vulnerability exists in Quantum Networks router due to missing rate limiting and CAPTCHA protection for failed login attempts in the we CVE-2026-410388.8This vulnerability exists in Quantum Networks router due to lack of enforcement of strong password policies in the web-based management inte CVE-2026-410397.5This vulnerability exists in Quantum Networks router due to improper access control and insecure default configuration in the web-based mana CVE-2026-41049.8Authorization bypass through User-Controlled SQL primary key vulnerability in Akmer Informatics Automation Industry and Trade Ltd. Co. Tekno CVE-2026-410408.7GROWI provided by GROWI, Inc. is vulnerable to a regular expression denial of service (ReDoS) via a crafted input string.